ReadonlyscopesApproved scopes; directory scopes cover descendant files.
Derive a non-extractable AES-GCM-256 key for WebCrypto encryption/decryption. Rejects directories and files outside approved scopes. Requires WebCrypto. Temporary JS key bytes are cleared after import, including on failure.
Derive a 32-byte content key for a canonical decoded file path. Rejects directories and files outside the approved scopes. The caller owns the JS byte copy and should clear it after use.
StaticfromRecover authenticated identity and keys from an exportLocalSecret() token offline.
Verifies the signed approval and grant binding even if the grant expired
or was revoked. Bare-grant tokens return undefined; signed approvals
without e scopes return a result with an empty key bundle.
Check publicKey (z-base-32) against the expected account and grantId
against the expected grant before using keys. Call keys.free() when done.
Verified scoped encryption keys obtained from a session or offline recovery. This object owns its secrets independently of the session and grants no storage access. Call
free()when finished; secret bytes are zeroized on free/drop.